Maintenance

Looking for an audible notification for lab machines with no speakers because I want to be able to run stuff and hear a response from across the room (perhaps it's lazy, but it's also convenient...).

It turns out that the pcspeaker is blacklisted in Ubuntu, so I had to turn it back on, like this:

sed -i 's/blacklist pcspkr/#blacklist pcspkr/' /etc/modprobe.d/blacklist.conf && modprobe pcspkr

The "beep" package will allow you to make some noise.: apt-get install beep

To test, run this command to play Funkytown:

beep -f 38 -l 3000 -n -f 392 -l 100 -n -f 38 -l 100 -n -f 392 -l 100 -n -f 38 -l 100 -n -f 349 -l 100 -n -f 38 -l 100 -n -f 392 -l 300 -n -f 38 -l 100 -n -f 294 -l 300 -n -f 38 -l 100 -n -f 294 -l 100 -n -f 38 -l 100 -n -f 392 -l 100 -n -f 38 -l 100 -n -f 523 -l 100 -n -f 38 -l 100 -n -f 494 -l 100 -n -f 38 -l 100 -n -f 392 -l 200

Or this one to play the theme from Beverly Hills Cop:

beep -f 659 -l 460 -n -f 784 -l 340 -n -f 659 -l 230 -n -f 659 -l 110 -n -f 880 -l 230 -n -f 659 -l 230 -n -f 587 -l 230 -n -f 659 -l 460 -n -f 988 -l 340 -n -f 659 -l 230 -n -f 659 -l 110 -n -f 1047 -l 230 -n -f 988 -l 230 -n -f 784 -l 230 -n -f 659 -l 230 -n -f 988 -l 230 -n -f 1318 -l 230 -n -f 659 -l 110 -n -f 587 -l 230 -n -f 587 -l 110 -n -f 494 -l 230 -n -f 740 -l 230 -n -f 659 -l 700

Or the Pink Panther theme:

beep -f 622.22 -l 200 -n -f 659.26 -l 300 -D 100 -n -f 738 -l 200 -n -f 784 -l 300 -D 100 -n -f 1046.50 -l 200 -n -f 993.60 -l 300 -D 100 -n -f 659.26 -l 200 -n -f 784 -l 300 -D 100 -n -f 993.60 -l 200 -n -f 936.8 -l 600 -n -f 880 -l 200 -n -f 784 -l 200 -n -f 659.26 -l 100 -n -f 587.33 -l 100 -n -f 659.26 -l 400

Previous post update: the problem appears to be a bug in the pam code itself which allows this kind of behaviour in some cases. The developer thinks it's possible that our system is allowing clients to anonymously bind. Fortunately there's a patch for that. Unfortunately recompiling PAM is close to being the last thing I want to do. Fortunately, there's a new version (v0.7.13 vs. the current v0.7.6) from Natty that installed with no drama. Also fortunately, it works!
I've installed it on carrot to test it in the real world.
I also spent a good deal of time submitting a bug report on Launchpad (Bug #720401).

I've finally gotten around to rebuilding onion and carrot with my latest script. No log in problems yet, but OOo may still be flaky. One user has had problem with insufficient user rights when saving documents. Investigating.

I'm working on an updated version that includes stuff like setting up a printer by default, providing a choice of lab or developer build (extra apps, no ldap login).
I've got the printer going by creating a /etc/cups/printers.conf file with info on the printer (make, model etc.) and putting a pre-made PPD at /etc/cups/ppd/HCMC.ppd. Finally, printers.conf needs to be chgrp'd to group "lp" and the cups service needs to be restarted.
I'm now working on making it a bit more informative (echos out what is about to happen, provides choices etc.)

Old scanner died.
Bought a new one (Canon CanoScan 8800F).
SANE website says it's fully supported by the PIXMA library.

Experience: under Lucid (libsane v1.0.20) I get nothing. I found a reference to a hack which requires editing a udev rule if it doesn't include the scanner info, but it apparently relies on a newer version of SANE (v1.0.21) - of course.

I tried it in Maverick, which includes v1.0.21 and it works.

I've updated my builder scripts for Maverick (Ubuntu 10.10). So far everything seems OK, but I've yet to test in a real-world environment (just in a VM, which has never been a problem).

It includes a backup builder that constructs a customized script for users to use for backing up data.

I'll build an ISO later this week and try it out on Radish.

Tomorrow morning, TB will arrive to start workstudy, working on the Wheelock Latin exercises (adding macrons). We decided that it might be simplest just to do this using a Windows VM, and it would be a good opportunity to figure out the best approaches to creating and managing VMs and storage for netlink users on the Linux boxes. This is what I did:

• Logged on as HCMC.
• Copied the generic Windows XP.vdi file to WinXPTheo.vdi (in the same folder).
• Started VirtualBox and added the new VDI to the media manager.
• Created a new VM with this VDI.
• Started the new VM, and logged on as hcmc.
• Installed required software (Hot Potatoes and WinSCP).
• Logged off the VM, and logged on again as WorkerBee.
• Made sure the software was installed and working, and downloaded a copy of the data for the project, into the user's My Documents folder.
• Shut down the VM.
• Logged off Linux and logged on as mholmes to create a PAM/netlink user.
• Logged off again, and logged on as HCMC.
• Copied the .VirtualBox folder from /home/hcmc/ to /home/netlink/mholmes/.
• Created a subfolder inside it called disks, and copied the VirtualBox VDI file into it.
• Edited /home/netlink/mholmes/.VirtualBox/VirtualBox.xml to change the path of the VDI file from /home/netlink/Shared/ to /home/netlink/mholmes/.VirtualBox/disks/.
• Logged off as hcmc, and logged back on as netlink mholmes.
• In /home/netlink/mholmes/, did su hcmc.
• As hcmc, did chown -R Holmes: .VirtualBox. (This can only be done this way, because the mholmes user only exists on the local machine while it's actually logged on.)
• As mholmes, started VirtualBox. FIRST AND ONLY PROBLEM: VirtualBox complained about the VDI file, saying it couldn't load it, although it had the path correct and the file was fine.
• In the VirtualBox media manager, Released the VDI file (which disconnects it from the VM).
• Removed it from the media manager.
• Added it back into the media manager.
• Added it as the HD for the VM.
• Started the VM and confirmed that everything was working.

The advantage and purpose in doing all this is that you can create and configure a VM for the project in advance, and then relatively quickly set it up for the person who'll be using it the first time they arrive and log on.

Issues I haven't yet addressed: The VM needs to be configured to mount a shared folder in the user's own documents (on the Linux side), and the data actually needs to be stored there. Then I need to write a script to back it up somewhere -- preferably Rutabaga -- so I can retrieve it.

A couple of odd issues have arisen that suggest that I need to tweak my config files.

Context: new machine build. No netlink users have logged in yet. Local
accounts log in fine. Auth stack config'd to talk to ldap1p on port 636.
The daemon I'm using (nslcd) is config'd to continue trying until it
gets a response. NOTE: I can't find details on how long it waits before
reporting a failure (no obvious TTL settings), but the results suggest
that it's either getting back a "auth failed" message from the server,
or the TTL is incredibly short.

Sequence:
1) Netlink user attempts login on machine "carrot". Fails with either
"Authentication Failure" or "no user account available" message at GDM.
This recurs 3 or 4 times (messages can switch back and forth) until
finally the login succeeds.
2) User immediately goes to another identically built machine and
successfully logs in first time.

I've repeated this 3 times this morning. I'll continue to monitor it
over the next few days as I'm still wondering if the local machine
caches users: as in, will previously-auth'd netlink users have no more
trouble logging in once they've succeeded?

Is it possible that if a user hasn't hit ldap1p for "a while" it'll take
several attempts to resuscitate the record from the db, but once it's
been accessed it responds more rapidly? One of the users logged in
successfully yesterday, but this morning (on a different machine) it
took 4 attempts to get auth'd. She then logged in to a third machine
with no trouble at all.

A conversation with an ldap sysadmin showed a decided lag in query/response time, but a completely local concern is that logged in users consistently (as in every hour or so) "lose" their name. If they launch a terminal they get a prompt like this:
I have no name!@carrot#:

I installed the ldap-utils package and ran ldapwhoami when the user lost their name and I got this:
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
I looked up the error and it's quite common when openldap clients try to connect with a Sun One Directory Server. OpenLDAP *wants* to use SASL, and SODS *won't* use it.

Apparently, client machines have an ongoing conversation with the ldap server, which may explain why we're getting the "I have no name!" problem: if the server doesn't respond, you have no name. I've also noticed that a test box that I have exhibits problems when coming out of screensaver mode. The screen remains black for as long as a minute before coming back with a gdm screen. I *think* it's not giving me a gdm screen until it makes contact with the server - which may be a while.

I've edited nslcd.conf to include:
sasl_mech ANONYMOUS
which apparently means no SASL (i.e. for unauthenticated guest access). If the "documentation" is accurate, this will stop trying to use SASL and all security will rest in the SSL domain.
NOTE: I got this hint from here.

Update: Looking at this, I *may* be able to cache credentials using the libpam-ccert package. The only question is, does it play nice with the new packages like nslcd etc.

In order to run rsnapshot I need either an IP name (e.g. unix.uvic.ca) or an IP address. This is because ultimately, rsnapshot runs an rsync command, which needs one of those IDs to get in to the client.

I investigated a number of tools that *should* be able to do this, but had no luck. So, my home-brew method goes like this:
1) install nmap
2) run this (all on one line):
nmap -sP 142.104.196.192/26|arp -na|grep -v "incomplete"|sed 's/\? (//g'|sed 's/) at/\t/g'|cut -d "[" -f1

You'll get back a tab-delimited result with IP address first followed by the MAC address of each responsive machine.

Ultimately, this will help construct a script that can be run from rutabaga that will build an up-to-date hosts file.

update: I've created such a script, using the collected MAC addresses of HCMC machines and storing them as variables. I then use sed to swap out MAC addresses for machine names. Seems to work well.

Wrote a script for lab users that will create a personalized backup/recovery script. It will be in the new build.

As an extra precaution, I'm also writing a script that runs when the user logs out. This will back up their Desktop and Documents folders to rutabaga. The trick is figuring out how to make it work. Lucid has a ~/.bash_logout file that looks promising, but it doesn't seem to work. What I've done (and it appears to be a sanctioned method for doing precisely what I want) is edit /etc/gdm/PostSession/Default to do my bidding. The script is not complete, but the basic spec is:

1) Set up sshkeys on the machines so that the administrative user can log in without interaction.
2) Ping rutabaga and make sure it's accessible over ssh. This will do nicely:
ssh -n -q -o "BatchMode=yes" gregster@rutabaga.hcmc.uvic.ca "echo 2>&1" && echo ":)" || echo ":("
3) If rutabaga answers, run the rsync as admin user and back up current user's stuff to rutabaga:/adminuser/labBackups/netlinkID/

NOTE: I'm using this as a guide.

UPDATE: testing indicates that /etc/gdm/PostSession/Default is the way to go. It's a script itself, so it needs to be edited to run the backup script(s). Logout appears to take as long as running the script, so a pop-up message telling users that logout might take a while would be polite.

NOTES:
/etc/gdm/PreSession/Default is called before graphical LOGIN

/etc/gdm/PostLogin/default is called directly after graphical LOGIN
before the graphical session starts (ie. it is a login script)

/etc/gdm/PostSession/Default is called directly after graphical LOGOUT